February 6, 2023

Home

Stay organized with collections

Save and categorize content based on your preferences.

Data Processing

Addendum for SecOps Consulting Services and Managed Services

Last modified: February 06, 2023

This is not the current version of this document and is provided for archival purposes.

View the current version

Covered services: Consulting Services and Managed Services (as defined below)

These Terms reflect the parties’ agreement with respect to the processing and security of Customer Data for Consulting Services and Managed Services that are subject to the Cloud Master Agreement General Terms and described in the applicable Statement of Work (“Agreement”).

1. Commencement

This Data Processing Addendum for Consulting Services and Managed Services, including the appendices (the “Terms”), will be effective and replace any previously applicable data processing and security terms for Consulting Services and/or Managed Services, as applicable, when and to the extent there is a direct conflict.

2. Definitions

2.1 Unless otherwise defined in these Terms, capitalized terms defined in the Agreement apply to these Terms. In addition, in these Terms:

• Adequate Country* *means:

(a) for data processed subject to the EU GDPR: the EEA, or a country or territory recognized as ensuring adequate protection under the EU GDPR;

(b) for data processed subject to the UK GDPR: the UK, or a country or territory recognized as ensuring adequate protection under the UK GDPR and the Data Protection Act 2018; and/or

(c) for data processed subject to the Swiss FDPA: Switzerland, or a country or territory that is: (i) included in the list of the states whose legislation ensures adequate protection as published by the Swiss Federal Data Protection and Information Commissioner, or (ii) recognized as ensuring adequate protection by the Swiss Federal Council under the Swiss FDPA; in each case, other than on the basis of an optional data protection framework.

• Alternative Transfer Solution means a solution, other than SCCs, that enables the lawful transfer of personal data to a third country in accordance with European Data Protection Law, for example a data protection framework recognized as ensuring that participating entities provide adequate protection.

• Consulting Services means the then-current advisory and implementation services described at

https://cloud.google.com/terms/secops/services

or in an applicable Order Form.

• Customer Data means data provided by or on behalf of Customer or Customer End Users in connection with receiving Consulting Services and/or Managed Services, as applicable, as further described in the applicable Statement of Work.

• Customer Personal Data means the personal data contained within the Customer Data, including any special categories of personal data defined under European Data Protection Law.

• Customer SCCs means the SCCs (Controller-to-Processor), the SCCs (Processor-to-Processor) and/or the SCCs (Processor-to-Controller), as applicable.

• Data Incident means a breach of Google’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data while processed by Google personnel or Subprocessors under the Agreement. For clarity, Data Incidents under this definition exclude previous incidents that are the subject of the Consulting Services and/or Managed Services, as applicable.

• EEA means the European Economic Area.